@redue/cli 0.1.0-alpha.26 → 0.1.0-alpha.28

package/src/cli.mjs

@@ -8,8 +8,8 @@ import {patternMatcher} from './glob.mjs';
 import {observedBy} from './installed-observation.mjs';
 import {changedFiles,coverageReadable,gitIgnored,recordedEnvironment,testEnvironmentIssue,testGuardConfig,testRunGuard,testRunFacts,sharedInstalledFile,testsInterpretation,testsQualification} from './test-direct.mjs';
 import {childProgram,generalIssue,lookup,pnpmConfigFiles,scriptCaches,scriptInstalledPaths,scriptInterpretation,scriptQualification,scriptRunFacts,pnpmNameless,toolOutput,toolchainDirs} from './node-script.mjs';
-import {denialLine,endWithChild,runToEnd,sandboxArgv,sandboxContext,sandboxDirs,sandboxEnv,sandboxInterpretation,sandboxPlaces,
-  sandboxQualification,sandboxSupport,systemPlaces} from './sandbox.mjs';
+import {denialLine,endWithChild,hiddenEntries,hiddenQualification,hiddenRefusal,isSandboxed,runToEnd,supervisorIssue,visibleChange,testRun as sandboxTestRun,sandboxArgv,sandboxContext,sandboxDirs,sandboxEnv,
+  sandboxInterpretation,sandboxInterpretationOf,sandboxPlaces,sandboxQualification,sandboxSupport,systemPlaces} from './sandbox.mjs';
 import path from 'node:path';
 import net from 'node:net';
 import os from 'node:os';
@@ -29,6 +29,7 @@ import {atomicJson,commitReceipt,readReceipts,receiptRevision} from './state-sto
 import {timing,profiling,mark,traceContext} from './decision-profile.mjs';
 import {readCachedStatus,unavailableCached} from './cached-state.mjs';
 import {renderRun} from './presentation.mjs';
+import {note} from './stats.mjs';
 
 mark('cli.loaded');
 const here=path.dirname(fileURLToPath(import.meta.url));
@@ -86,7 +87,7 @@ function environmentReads() {
 }
 const recordedRecipes=[testsQualification,scriptQualification];
 // A sandboxed check's run is recorded where its sandbox cannot start (execute).
-function contextHashes() {const reads=config.checks.some(check=>[...recordedRecipes,sandboxQualification].includes(check.qualification))?environmentReads():{};
+function contextHashes() {const reads=config.checks.some(check=>recordedRecipes.includes(check.qualification)||isSandboxed(check.qualification))?environmentReads():{};
   return Object.fromEntries(config.checks.map(check=>[
   check.name,Object.fromEntries([...(check.environment?.variables||[])
     .map(key=>[key,digest(process.env[key]??'<unset>')]),
@@ -99,7 +100,7 @@ function contextHashes() {const reads=config.checks.some(check=>[...recordedReci
       `__vstate_path_executable_${name}__`,pathExecutableIdentity(name)]),
     ...(check.environment?.executableIdentity?[['__vstate_node_identity__',nodeIdentity()]]:[]),
     // A sandboxed run's environment, toolchain and places (sandbox.mjs).
-    ...(check.qualification===sandboxQualification?Object.entries(sandboxContext(check,process.env,root)):[]),
+    ...(isSandboxed(check.qualification)?Object.entries(sandboxContext(check,process.env,root)):[]),
     // The variables the last test run read directly, compared here: which
     // list was compared, and the first variable whose value now differs.
     // Control requests are small, so the values stay out of them.
@@ -299,7 +300,7 @@ async function execute() {
     // A sandboxed check runs inside the OS sandbox. Where the sandbox cannot
     // start, a script the general recipe takes is recorded as that recipe
     // records it (`fallback`); any other runs as it is, and is not reused.
-    const sandboxed=selected.qualification===sandboxQualification,support=sandboxed?sandboxSupport():null;
+    const sandboxed=isSandboxed(selected.qualification),support=sandboxed?sandboxSupport():null;
     const fallback=Boolean(support?.issue&&typeof selected.script==='string'&&!generalIssue(root,selected.script));
     // A test run's processes record what the guard checks (test-recorder.cjs),
     // and so do a general recipe run's, through the package manager.
@@ -330,8 +331,21 @@ async function execute() {
       if(support.issue)captureIssues.push(`the run was not sandboxed: ${support.issue}`);
       else{
         const dirs=sandboxDirs(state,name);
+        // A test run: loopback networking, supervised on Linux (the launcher
+        // reports in REDUE's state, outside what the test may touch), a
+        // private /tmp, and a fresh home each run: what a test leaves in its
+        // home is not observed, so it must not reach a later run.
+        const tests=sandboxTestRun(selected),stats=tests&&support.mode==='landlock'?path.join(state,`launcher-${runId}.json`):null;
+        if(tests){dirs.home=path.join(dirs.tmp,'home');fs.mkdirSync(dirs.home,{mode:0o700});}
         const reads=[root,dirs.home,dirs.tmp,...sandboxPlaces(selected,process.env,root),...systemPlaces];
-        sandbox={mode:support.mode,dirs,argv:sandboxArgv(support.mode,command,{reads,tmp:dirs.tmp,python:support.python}),
+        // sandbox-v2 hides the checkout's git-ignored entries. Where git
+        // cannot list them, nothing is hidden, and the receipt compares every file.
+        const hidden=selected.qualification===hiddenQualification?hiddenEntries(root):null;
+        const options={reads,tmp:dirs.tmp,python:support.python,stats,
+          ...tests?{network:'loopback',writes:[root,dirs.home,dirs.tmp],
+            fault:process.env.VSTATE_TEST_FAULTS==='1'?process.env.VSTATE_TEST_SUPERVISOR||null:null}:{}};
+        sandbox={mode:support.mode,dirs,reads,hidden,options,stats,
+          argv:sandboxArgv(support.mode,command,{...options,hidden:(hidden||[]).map(rel=>path.join(root,rel.replace(/\/$/,'')))}),
           env:sandboxEnv(selected,process.env,{root,...dirs})};
       }
     }
@@ -476,6 +490,17 @@ async function execute() {
       unexplained=touched.filter(file=>!ignored.has(file));
       if(!unexplained.length){eventsExplained=true;if(changed.length)outputs=changed;}
     }
+    // A run that hid git-ignored files: what it wrote beneath them (test
+    // output, coverage data) is not a change to its inputs (visibleChange);
+    // anything else is named.
+    let hiddenOnly=false;
+    if(sandbox?.hidden&&snap&&end&&snap.planId===end.planId&&snap.observationHealthy&&end.observationHealthy&&
+      (snap.inputEventSerial===end.inputEventSerial||end.inputEventPathsComplete===true)){
+      const before=snap.files||{},after=end.files||{},events=end.inputEventPaths||[];
+      // During the run a new file outside the hidden entries was readable: it counts.
+      const found=visibleChange(root,sandbox.hidden,before,after,[...Object.keys(before),...Object.keys(after),...events],{during:true});
+      if(found===null){eventsExplained=true;hiddenOnly=true;}else unexplained=[found];
+    }
     // The end certificate, recorded or probed, must cover what this compile received.
     // With no input event, gap or content change in between, it also holds at the start.
     // A run checked by full probes is compared with it too, for its run facts.
@@ -514,8 +539,47 @@ async function execute() {
         `: ${named.slice(0,5).join(', ')}${more>0?` and ${more} more`:''}`:'')+unrecorded);
     }
     // A recorded certificate changes only the probe part of the fingerprint.
-    if(!outputs&&(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
+    if(!outputs&&!hiddenOnly&&(!snap||!end||snap.planId!==end.planId||(recording?snap.inputKey!==end.inputKey:snap.fingerprint!==end.fingerprint)||
       snap.revision!==end.revision))captureIssues.push('declared inputs changed or were not observed');
+    // A run that hid git-ignored files and failed with a refusal that names
+    // one runs again in the sandbox without hiding them: the check needs
+    // them. That run's result is kept, compared on every file, when the
+    // inputs held through it too. Its own refusal is handled as below.
+    let hiddenRerun=null;
+    if(sandbox?.hidden?.length&&result==='FAIL'&&!requestedSignal){
+      const line=hiddenRefusal(output.head+'\n'+output.tail,sandbox.hidden);
+      if(line){
+        console.error(`redue: the sandboxed run failed with what looks like a refusal of a file git ignores (${line}); running it again in the sandbox without hiding them`);
+        const again=await runToEnd(sandboxArgv(sandbox.mode,command,sandbox.options),
+          {cwd:plan.cwd,env:sandbox.env,echo:true,started:child=>{activeChild=child;}});
+        activeChild=null;
+        hiddenRerun={line,exitCode:again.status,signal:again.signal||null,...again.error?{errorCode:again.error.code||again.error.name}:{}};
+        if(requestedSignal){
+          captureIssues.push('interrupted during the run without hidden files');
+          Object.assign(invocation,{status:'interrupted',exitCode:null,signal:requestedSignal});
+        }
+        else if(again.error||again.status===null)
+          captureIssues.push(`the run without hidden files did not finish (${again.error?.code||again.signal}), so a refusal of a file git ignores is not ruled out (${line})`);
+        else{
+          const wait=decisionWait(process.env.VSTATE_CAPTURE_TIMEOUT_MS);
+          // Inputs, plan, observer and environment held through it as through the first run.
+          let confirmed=null;const environmentNow=contextHashes()[name];
+          try{confirmed=await call({action:'snapshot',name,contextHashes:contextHashes(),
+            ...Number.isSafeInteger(snap?.inputEventSerial)?{sinceSerial:snap.inputEventSerial}:{}},wait.timeout,wait.deadline);}catch{}
+          const last=confirmed?.snapshots?.[name];
+          if(!last?.observationHealthy||!snap||last.planId!==snap.planId||last.fingerprint!==snap.fingerprint||last.revision!==snap.revision||
+            last.inputEventSerial!==end?.inputEventSerial||last.planGeneration!==snap.planGeneration||
+            confirmed.observation?.generation!==before?.observation?.generation)
+            captureIssues.push('declared inputs changed or were not observed during the run without hidden files');
+          if(JSON.stringify(environmentNow)!==JSON.stringify(environmentBefore))
+            captureIssues.push('declared environment changed during the run without hidden files');
+          invocation.hiddenExitCode=invocation.exitCode;invocation.exitCode=again.status;
+          result=again.status===0?'PASS':'FAIL';
+          output.head=`${again.stdout}\n${again.stderr}`.slice(0,65536);output.tail='';
+          sandbox.hidden=null;
+        }
+      }
+    }
     // A sandboxed run that failed with what looks like a refusal by the
     // sandbox runs again outside it. When that run exits differently, the
     // sandbox changed the result: the plain run's result is kept, not reused.
@@ -542,6 +606,8 @@ async function execute() {
         }
       }
     }
+    // A test run whose network was not supervised throughout is not reused.
+    if(sandbox?.stats){const issue=supervisorIssue(sandbox.stats);if(issue)captureIssues.push(issue);fs.rmSync(sandbox.stats,{force:true});}
     if(sandbox)fs.rmSync(sandbox.dirs.tmp,{recursive:true,force:true});
     const stable=captureIssues.length===0;
     // Two runs on the same inputs, environment and plan that disagree make the
@@ -562,7 +628,9 @@ async function execute() {
     // A recorded run's receipt carries its run facts, even none; observers that
     // predate run facts do not reuse version 2.
     // The recipe that made the receipt, which status and the hook name.
-    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,recipe:(fallback?scriptQualification:selected.qualification)||null,
+    // A sandboxed receipt names what the run did: hid the git-ignored files or not.
+    const receipt={result,invocation,target,stable,fingerprintVersion:recorded||testRun?2:1,
+      recipe:(fallback?scriptQualification:own?(sandbox?.hidden?hiddenQualification:sandboxQualification):selected.qualification)||null,
       ...(recorded||testRun?{runFacts}:{}),
       ...(testRun?{verificationRecipe:general?scriptInterpretation:testsInterpretation,guardIssues:guard?.issues||['the run record is unavailable'],
         environmentReads:guard?.environmentReads||{},...(nondeterministic?{nondeterministic}:{})}:{}),
@@ -576,12 +644,15 @@ async function execute() {
       planId:snap?.planId??plan.id,fingerprint:(recording||outputs?end:snap)?.fingerprint??null,
       provider:plan.provider,environmentHashes:environmentBefore,
       ...(observedContext?{observedContext,verificationRecipe:directInterpretation}:{}),
-      ...(own?{verificationRecipe:sandboxInterpretation,sandbox:{mode:sandbox?.mode??null,...sandboxRerun?{rerun:sandboxRerun}:{}}}:{}),
+      // `hidden`: the git-ignored entries the run did not see, which the observer does not compare.
+      ...(own?{verificationRecipe:sandbox?.hidden?sandboxInterpretationOf(hiddenQualification):sandboxInterpretation,
+        sandbox:{mode:sandbox?.mode??null,hidden:sandbox?.hidden??null,...hiddenRerun?{hiddenRerun}:{},...sandboxRerun?{rerun:sandboxRerun}:{}}}:{}),
       ...(fallback?{sandbox:{mode:null,fallback:'node-script',issue:support.issue}}:{}),
       files:(outputs?end:snap)?.files??null,observerGeneration:before?.observation?.generation??null,
       startRevision:snap?.revision??null,endRevision:end?.revision??null};
     const persistenceStarted=performance.now();
     commitReceipt(state,name,receipt);
+    note(state,{kind:'run',check:name,ms:invocation.durationMs??null,result,stable});
     if(testRun){const reads=environmentReads();reads[name]=receipt.environmentReads;atomicJson(readsFile,{schema:1,checks:reads});}
     timing('cli.receipt_persistence',persistenceStarted);
     const reloadStarted=performance.now();
@@ -671,7 +742,8 @@ async function main(){
           await new Promise(r=>setTimeout(r,100));
         if(fs.existsSync(path.join(state,'observer.lock')))throw Error('observer did not stop');}
     }
-    fs.rmSync(state,{recursive:true,force:true});
+    // A stopping observer can still be closing its files (Windows: ENOTEMPTY, EBUSY).
+    fs.rmSync(state,{recursive:true,force:true,maxRetries:10,retryDelay:200});
     console.log(JSON.stringify({removed:state}));return;
   }
   if(action==='status'){console.log(JSON.stringify(cached()));return;}

package/src/daemon.mjs

@@ -25,7 +25,7 @@ import {npmCacheDir} from './npm-integrity.mjs';
 import {runFromArgv} from './typescript-invocation.mjs';
 import {buildInfoPath,recordedCertificate} from './direct-run-certificate.mjs';
 import {timing,mark,traceBase,traceContext,traceScope,traceEnvironment,traceId} from './decision-profile.mjs';
-import {sandboxChange} from './sandbox.mjs';
+import {isSandboxed,sandboxChange,visibleChange as sandboxVisibleChange} from './sandbox.mjs';
 
 const configFile=path.resolve(process.argv[2]);
 const config=JSON.parse(fs.readFileSync(configFile));
@@ -348,6 +348,16 @@ function describeChangedInput(plan,file) {
     .map(mapping=>mapping.logical).slice(0,2);
   return file+' changed'+(matches.length?` (installed via ${matches.join(', ')})`:'');
 }
+// A run that hid the checkout's git-ignored entries (sandbox@2): the first
+// changed input it could see (sandbox.mjs's visibleChange), or null; once
+// per receipt and pair of fingerprints.
+const hiddenRun=r=>Array.isArray(r?.sandbox?.hidden)&&Boolean(r.files);
+function visibleChange(row,r,name) {
+  const key=(r.invocation?.runId||'')+'\0'+r.fingerprint+'\0'+combinedSummary(name).fingerprint;
+  if(row.visibleKey!==key){const current=combinedFiles(name);
+    row.visibleKey=key;row.visibleChange=sandboxVisibleChange(root,r.sandbox.hidden,r.files,current,[...Object.keys(r.files),...Object.keys(current)]);}
+  return row.visibleChange;
+}
 function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=false) {
   if(!index)return [];
   return [...index.checks].map(([name,row])=>{
@@ -368,7 +378,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       return item;}
     if(pendingChecks.has(name)){item.reason='filesystem change pending content inspection';return item;}
     if(r&&r.planId) item.declared_inputs_match=r.planId===row.plan.id&&
-      r.fingerprint===combinedSummary(name).fingerprint;
+      (r.fingerprint===combinedSummary(name).fingerprint||hiddenRun(r)&&visibleChange(row,r,name)===null);
     if(r&&!(r.fingerprintVersion===1||r.fingerprintVersion===2&&Array.isArray(r.runFacts))){
       item.reason='receipt uses earlier input-resolution format';return item;}
     if(row.plan.unresolved.length){
@@ -400,7 +410,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       item.reason='target failure conflicts with outer invocation outcome';return item;}
     if(!r.stable){const issues=r.checkpoint?.issues?.length?` (${r.checkpoint.issues.join('; ')})`:'';
       // A sandboxed run that could not start, whose result the sandbox changed, or whose rerun outside it did not finish, says so alone.
-      const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox)/.test(issue));
+      const sandbox=r.checkpoint?.issues?.length&&r.checkpoint.issues.every(issue=>/^the (?:sandbox changed|run was not sandboxed|run outside the sandbox|network supervisor)/.test(issue));
       item.reason=sandbox?r.checkpoint.issues.join('; '):`inputs changed during execution or observation gap${issues}`;return item;}
     const names=[...(row.plan.environment.variables||[]),
       ...(row.plan.environment.prefixes||[]).map(prefix=>
@@ -410,7 +420,7 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
       ...(row.plan.environment.executableIdentity?['__vstate_node_identity__']:[])];
     // A sandboxed run's variables, toolchain, PATH directories and places
     // (sandbox.mjs): every entry either side has, and the first change named.
-    const sandboxChanged=row.plan.qualification==='sandbox-v1'&&contextHashes?.[name]?
+    const sandboxChanged=isSandboxed(row.plan.qualification)&&contextHashes?.[name]?
       sandboxChange(r?.environmentHashes,contextHashes[name]):null;
     if(names.length&&!contextHashes?.[name])unconfirmed??='execution environment context not supplied';
     item.freshness='STALE';
@@ -431,8 +441,10 @@ function rows(contextHashes,synchronizedInstalled=false,synchronizedFilesystem=f
         item.freshness='UNVERIFIED';item.reason='environment variables the last run read were not compared';}
       else item.reason=`environment variable ${contextHashes[name].__redue_env_changed__} differs from the last run`;
     }
-    else if(r.fingerprint!==combinedSummary(name).fingerprint) {
+    else if(r.fingerprint!==combinedSummary(name).fingerprint&&!(hiddenRun(r)&&visibleChange(row,r,name)===null)) {
       const key=r.fingerprint+'\0'+combinedSummary(name).fingerprint;
+      if(row.staleReasonKey!==key&&hiddenRun(r)){
+        row.staleInputs=[visibleChange(row,r,name)];row.staleReason=describeChangedInput(row.plan,row.staleInputs[0]);row.staleReasonKey=key;}
       if(row.staleReasonKey!==key){
         let changed=row.lastReason;row.staleInputs=[];
         const candidate=changed?.endsWith(' changed')?changed.slice(0,-8):null;
@@ -807,7 +819,7 @@ function markInputEvent(name,rel,type,replay) {
     const serial=(inputEventSerial.get(name)||0)+1;
     inputEventSerial.set(name,serial);
     // Kept only for recorded test and script checks and sandboxed ones; trimmed in batches.
-    if(['npm-tests-direct-v1','node-script-v1','sandbox-v1'].includes(index?.checks.get(name)?.plan.qualification)){
+    if(['npm-tests-direct-v1','node-script-v1'].includes(index?.checks.get(name)?.plan.qualification)||isSandboxed(index?.checks.get(name)?.plan.qualification)){
       const list=inputEventPaths.get(name)||[];list.push([serial,rel]);
       if(list.length>2*eventPathLimit)list.splice(0,list.length-eventPathLimit);inputEventPaths.set(name,list);
     }

package/src/declared-plan.mjs

@@ -8,7 +8,7 @@ import {qualifyTypeScript} from './typescript-qualification.mjs';
 import {directBuildInfo} from './direct-typescript.mjs';
 import {qualifyTests,testWorkspacePatterns,testsQualification} from './test-direct.mjs';
 import {qualifyNodeScript,scriptQualification} from './node-script.mjs';
-import {qualifySandbox,sandboxInstalledExclusions,sandboxQualification} from './sandbox.mjs';
+import {isSandboxed,qualifySandbox,sandboxInstalledExclusions} from './sandbox.mjs';
 import {yarnWorkspaceTypecheckInputs} from './yarn-workspace-inputs.mjs';
 import {pnpmTypecheckInputs} from './pnpm-inputs.mjs';
 import {checkRun} from './typescript-invocation.mjs';
@@ -81,7 +81,7 @@ export function discoverDeclared(config) {
     const excluded=buildInfo?['!'+buildInfo]:[];
     // A sandboxed check leaves out the .venv's links that lead out of the
     // checkout; its qualification names them.
-    const sandboxed=selected.qualification===sandboxQualification;
+    const sandboxed=isSandboxed(selected.qualification);
     if(sandboxed)excluded.push(...sandboxInstalledExclusions(root));
     const installedStarted=performance.now();
     const installed=resolveDeclaredInstalled(root,

package/src/index.mjs

@@ -6,6 +6,7 @@ import micromatch from './glob.mjs';
 import {sha} from './plan.mjs';
 import {resolveLinks} from './installed-inputs.mjs';
 import {validInputRelative,identityFields,racyUntil} from './path-identity.mjs';
+import {isSandboxed} from './sandbox.mjs';
 
 const tracked = root => [...new Set(execFileSync('git',
   ['ls-files','--cached','--others','--exclude-standard','-z'],
@@ -204,7 +205,7 @@ export class InputIndex {
         // (its package.json stands for them).
         // The second form is for recorded checks only: their recorder
         // classifies a read through the link where it leads.
-        const recorded=name=>['node-script-v1','npm-tests-direct-v1','sandbox-v1'].includes(this.checks.get(name).plan.qualification);
+        const recorded=name=>['node-script-v1','npm-tests-direct-v1'].includes(this.checks.get(name).plan.qualification)||isSandboxed(this.checks.get(name).plan.qualification);
         const observedDir=installed?physical=>!this.includeInstalled&&
           ([...this.installedRootSet].some(root=>physical.startsWith(root+'/'))||
             !physical.split('/').includes('node_modules')&&!this.installedPath(physical+'/package.json')&&matched.every(recorded))&&